PWS_for_ISO_Support_amended.docx

Performance Work Statement (PWS) For

INFORMATION SECURITY SUPPORT SERVICES

PART 1

GENERAL INFORMATION

1.1 Description of Services/Introduction:

The contractor shall provide all personnel, equipment, tools, materials, supervision, and other items and non-personal services necessary to perform INFORMATION SECURITY SUPPORT SERVICES as defined in this Performance Work Statement, except as Specified in section C-3 as government furnished property and services at the MINE SAFETY AND HEALTH ADMINISTRATION. The contractor shall perform to the standards in this contract.

1.2 Background:

The Mine Safety and Health Administration (MSHA) Standardized Information System (MSIS) is a Web-based application. The application is accessible to any MSHA computer connected to the Local Area Network (LAN). The central Oracle database is located at the MSHA Information Technology Center (ITC) in Lakewood, Colorado. The Oracle Sun Servers uses WebLogic to host the MSIS application. A Data Warehouse Oracle database resides on another Oracle Sun Server with Oracle data files residing on an EMC SAN attached storage device. The MSIS eGov forms are external facing which are used by the public to submit forms to MSHA electronically.

The purpose of this contract is to acquire services including information security and management support for mission-critical business functions to achieve MSHA’s mission in protecting the safety and health of the nation’s miners.

1.3 Objectives:

This Performance Work Statement (PWS) describes the deliverable and tasks required to provide the United States Mine Safety and Health Administration (MSHA) for MSIS. The contractor shall provide services to accomplish the tasks described in this PWS.

1.4 Scope:

The Mine Safety and Health Administration (MSHA) has a need for information security analysis, auditing and operation support. The individuals shall be subject matter experts on information security and privacy policies and procedures, draft policies and procedures for MSHA, and assist a senior level (federal) Information System Security Officer (ISSO) on information system, continuous monitoring, and risk management activities.

MSHA is seeking individuals that can work on information security, information assurance, continuous monitoring and security day-to-day operational activities.

1.5 Period of Performance:

Period of performance shall be for one (1) Base Period of 12 months and four (4) 12-month option periods. The Period of Performance reads as follows:

The Government reserves the right to extend the term of this contract at the prices set forth in Section B in accordance with the terms and conditions contained in clause 52.217-9 entitled, “Option to Extend the Term of the Contract”.

1.6 General Information

1.6.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. As a minimum, the contractor shall develop quality control procedures that address the areas identified in Technical Exhibit 1, “Performance Requirements Summary”. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system. The Contractor shall submit a draft Quality Control Plan within 15 calendar days of award.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Government Remedies: The contracting officer shall follow FAR 52.212-4, “Contract Terms and Conditions-Commercial Items” or 52.246-4, “Inspection of Services-Fixed Price” for contractor’s failure to perform satisfactory services or failure to correct non-conforming services.

1.6.4 Recognized Holidays: The Government hereby provides NOTICE and Contractor hereby acknowledges RECEIPT that Government personnel observe the listed days as holidays.

In addition to the days designated as holidays, the Government observes the following days:

Any other day designated by Federal Statute Any other day designated by Executive Order Any other day designated by the President’s Proclamation

The contractor shall comply with the aforementioned Government holidays and any other day designated by Federal Statute, Executive Order, or Presidential proclamation. Therefore the Government offices are closed to the Contractor’s staff on the day(s) these holidays are observed. In addition, work shall not be required of the contractor when Federal employees are released from work early due to inclement weather conditions or emergencies or when Federal offices are closed to inclement weather conditions or emergencies (status is available at hltp://www.opm.gov/status/). The COR will notify the Contractor when early release of Federal employees has been authorized.

1.6.5 Hours of Operation/Place of Performance: The contractor is responsible for conducting work performed on-site between the hours of 6:00am to 8:00PM EST/EDT Monday thru Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Work shall be performed on-site, except for assignments requiring travel. Off-site work may be approved at the discretion of the COR. An 80 hour bi-weekly schedule within PEIR office hours shall be negotiated after award between the vendor and the COR. The Contractor must at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this statement of work when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the work force are essential. Telecommuting or “work at home” is not authorized under this contract unless under emergency situations as determined by the COR.

Off-site work may be approved at the discretion of the COR. Some tasks may need to be performed outside normal office hours to eliminate or minimize the impact on the user community. When work is performed outside the normal hours of operation, contract staff will be allowed, in consultation with the Task Manager, to adjust their weekly schedule accordingly. The Contract employees are not under any circumstance authorized to work overtime hours nor are they allowed to make-up work hours missed under this contract. The Contract shall in the performance of this contract immediately notify the COR of the MSHA Point of Contact if the time and/or service obligations of this contract cannot be met because inclement weather, civil disturbances, equipment failure, illness, etc. MSHA recognizes the obligation of the Contract no later than 9:00am on the day the services were scheduled to be provided if any circumstance prevent timely performance. The contract employee will be required to track their daily work hours. Hours worked are covered under the Firm-Fixed-Price Agreement.

All tasks performed under this order will be conducted at the following location:

Mine Safety and Health Administration 201 12th Street South Arlington, VA, 22202

Mine Safety and Health Administration One Denver Federal Center Building 25, Second Street, E-18 Denver, Colorado 80225-0367

Arlington Quantity one (1) - Project Manager Quantity two (2) - Information System Analyst

Denver Quantity one (1) - Information System Auditor

1.6.6 Type of Contract: The government anticipates award of a Firm-Fixed-Price Agreement

1.6.7 Security Requirements: Contractor staffs are required to conform to MSHA’s security and privacy requirements as described below. Contractor’s staff is required to conform to DOL's security and privacy requirements as described in Technical Exhibit 4, Contractor Personnel Security Requirements.

1.6.7.2.2 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.7.3 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.7.4 Conservation of Utilities. The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

1.6.7.8 The Contractor shall comply with agency personal identity verification procedures identified in the contract the implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

1.6.7.9 The Contractor shall insert this clause in all subcontracts when the subcontract is required to have physical access to federally controlled facility or access to a Federal information system.

1.6.7.9.1 Privacy: Due to sensitive nature of the tasks in this order, contract staff shall be required to sign a non-disclosure agreement prior to starting work. Portions of information disclosed during the performance of this task are protected by the provisions of the Privacy Act of 1974; therefore, all personnel assigned to this task are required to take proper precautions to protect the information from disclosure.

1.6.7.9.2 Ownership: All products and deliverable developed under this contract are the property of the U.S. Government and the Mine Safety and Health Administration (MSHA).

1.6.7.9.3 Commitment to Protect Sensitive Information: The Contractor shall not release, publish, or disclose sensitive information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of sensitive information: 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records).

1.6.7.9.4 Required Security Training: All MSHA employees and contractors must receive security awareness training prior to being given access to MSHA systems and periodically thereafter as required by MSHA security policies/

1.6.8 Special Qualifications: In light of MSHA’s unique, mission critical functions, the support needed by the Information Security Office (ISO); the following certifications are required of the prime contractor and any subcontractor:

Capability Maturity Model Integration (CMMI) SVC Level 3. The Offeror shall be appraised at CMMI Level 3 SVC or higher at time of proposal submission and shall maintain it during the contract period. A copy of the CMMI level 3 appraisal certificate shall be submitted as part of the proposal. The Offeror shall provide POC information that includes the name of the Certification body and name, address, phone number, and email of the representative who provided the CMMI Maturity Level. The offer shall make reference to the page number and paragraph of the certification or letter that determined the approval of the CMMI Maturity Level.

ISO 9001. ISO 9001 is a quality management system developed by the International Organization for Standardization. A copy of the Offeror’s official certification from an approved current ISO 9001 certification body shall be submitted as part of the proposal. The Offeror shall provide POC information that includes the name of the Certification body and name, address, phone number, and email of the representative who provided the ISO 9001 Certification. The offer shall make reference to the page number and paragraph of the certification or letter that determined the approval of the ISO 9001 Certification. The Offeror shall be ISO 9001 certified at the time of the proposal submission.

ISO 27001. ISO/IEC 27000 is part of a growing family of ISO/IEC Information Security Management Systems (ISMS) standards, the 'ISO/IEC 27000 series'. ISO/IEC 27000 is an international standard entitled: Information technology — Security techniques — Information security management systems — Overview and vocabulary. The Offeror must provide verification of ISO/IEC 27000 Certification. A copy of the Offeror’s official certification from an approved ISO/IEC 27000 certification body shall be submitted as part of the proposal. The Offeror shall provide POC information that includes the name of the Certification body and name, address, phone number, and email of the representative who provided the ISO/IEC 27000 Certification. The offer shall make reference to the page number and paragraph of the certification or letter that determined the approval of the ISO/IEC 27000 Certification. The Offeror shall be ISO 27001certified at the time of the proposal submission and a copy of the certification shall be submitted as part of the proposal.

ISO 20000. ISO/IEC 20000 is the international standard specifically for an IT Service Management System consisting of an integrated set of processes for the effective delivery of services to the business and its customers. The Offeror must provide verification of ISO 20000 Certification. A copy of the Offeror’s official certification from an approved ISO 20000 certification body shall be submitted as part of the proposal. The Offeror shall provide POC information that includes the name of the Certification body and name, address, phone number, and email of the representative who provided the ISO 20000 Certification. The offer shall make reference to the page number and paragraph of the certification or letter that determined the approval of the ISO 20000 Certification. The Offeror shall be ISO 20000 certified at the time of the proposal submission and a copy of the certification shall be submitted as part of the proposal. Offeror shall be ISO 20000 certified at the time of the proposal submission and shall maintain it during the contract period.

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer Representative (COR): A COR will be delegated under separate cover.

1.6.11 Contract Manager: The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

1.6.12 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel will be required to obtain and wear badges in the performance of this service.

1.6.13 Section 508 Accessibility: Section 508 of the Rehabilitation Act of 1973 requires that Federal agencies’ electronic and information technology (EIT) is accessible to people with disabilities. The Federal Acquisition Regulations (FAR) Final Rule for Section 508 can be found at www.section508.gov. The Federal Electronic and Information Technology Accessibility Standards (36 CFR 1194) are incorporated into and made a part of this PWS. These standards may be found at the Section 508 standards page within the website, above. The Contractor must comply with these standards in performing under this PWS.

1.6.14 Project Manager: The contractor shall provide a Project Manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

1.6.15 Contractor Oversight: Contractor shall provide sufficient oversight of the contract in order to ensure that contractor employees are functioning within their designated labor categories. The contractor shall ensure that all personnel provided to the Department of Labor under this contract, are professionally certified and trained, and certifications and experience are current with the state of technology required to support this PWS. In positions requiring certification the contractor employees shall be required to maintain their certification at the highest level of software required by the PWS at no additional cost to the Department of Labor. All activities performed are within contract guidelines. Employee positions are filled and maintained by qualified competent personnel.

1.6.16 Designated Government Representative (DGR) or DGR designee. The government representative that the contractor shall assist and serve as a liaison for MSHA in internal and external meetings, providing reports and updates.

Mr. Iftikhar Khan Mine Safety and Health Administration 201 12th St S Arlington, VA 22202 Phone: 202-693-9766 E-Mail: khan.iftikhar@dol.gov

1.6.17 Conflict of Interest: The Contractor shall not employ any person who is an employee of the United States government, if that employment would appear to cause conflict of interest.

1.6.17 Employee Conduct: Contractor employees shall present a professional appearance at all times and their conduct shall not reflect discredit upon the United States and or the Department of Labor.

1.6.17.1 Interrelationships of Contractors

The Department of Labor has entered into contractual relationships in order to provide support services in the conduct of appropriate studies, analyses, and engineering activities, separate from the work to be performed under this contract, yet having links and interfaces to them. The contractor may be required to coordinate with such other contractor(s) through the COTR in providing suitable, non-conflicting technical interfaces and in avoidance of duplication of effort. Other contractor(s) may be requested to assist the Department of Labor in the technical review of the contractor’s technical efforts. Information on reports provided under this statement of work may, at the discretion of the Department of Labor, be provided to such other contractor(s) for the purpose of such review. The Department of Labor acknowledges the contractor has the right to ask that proprietary information requested not be given to other vendors pursuant to the Non-Disclosure Clause and the Non-Disclosure Agreement signed by each Contractor employee working on this contract.

1.6.17.2 Non-disclosure Agreement

The Contractor shall require each contractor employee to review and sign the attached non-disclosure agreement when he or she begins work on the DOL contract. The Contractor must send the signed copy to the COTR.

1.6.17.2 Disclosure of Confidential Information

The Contractor agrees to maintain the confidentiality of any information regarding project-related data and artifacts. Data includes personally identifiable information (PII), disclosure of which is regulated by the Privacy Act of 1974, PL 93-579, as amended.

1.6.17.3 Elimination of Sexist Language and Art Work

All written materials issued by the Contractor or grantee shall conform to the following guidelines for eliminating sexist language and art work:

(a) Avoid the use of sex reference in job titles. Titles should conform to the Census Bureau's occupational classification system and the most recently published edition of the Dictionary of Occupational Titles.

-- Longshore workers instead of longshoremen.

(b) Avoid the use of male and female gender word forms.

-- Aviator to include men and women pilots, not aviatrix.

(c) Include both sexes by using terms that refer to people as a whole.

-- Human beings or people instead of mankind.

(d) Avoid the use of masculine and feminine pronouns or adjectives in referring to a hypothetical person or people in general. Change sentences such as: The average American worker spends 2 years of his life in the workforce.

-- By rewording to eliminate unnecessary gender pronouns and adjectives. (The average American worker spends 20 years in the workforce.)

-- By recasting into the plural. (Most Americans spend 20 years of their lives in the workforce.)

-- By replacing the masculine or feminine pronoun or adjective with "one", "you", "he or she", "her or him", or his or her". (An average American spends 20 years of his or her life in the workforce.)

(e) Refer to both men and women in such generic terms as economist, doctor, or lawyer. Identify sex through the use of pronouns.

-- The lawyer made her final summation.

(f) Avoid the use of stereotyped terms or expressions such as "man-sized" job.

-- Employee-years and employee-hours (or staff-hours) instead of man-years and man-hours.

(g) The use of art work in publications should conform to the following guidelines:

(i) Strive to use racially and sexually balanced designs.

(ii) Depict both men and women in art work on general subject matters.

(iii) Show men and women in a variety of roles in photographs, illustrations, and drawings.

-- Show women and men as managers and skilled laborers.

1.6.17.4 Publication of Materials

The Contractor shall receive permission from the Contracting Officer prior to publishing any works performed under this contract. Further, the Contractor shall acknowledge the support of the Department of Labor whenever publicizing any work performed under this contract. To implement the foregoing, the Contractor shall include in any publication resulting from work performed under this contract, an acknowledgement substantially the same as follows:

"This project has been funded, either wholly or in part, with Federal funds from the Department of Labor, Office of the Assistant Secretary for Administration and Management under Contract Number N/A the contents of this publication do not necessarily reflect the views or policies of the Department of Labor, nor does mention of trade names, commercial products, or organizations imply endorsement of same by the U.S. Government."

1.6.18 Contractor Travel: Travel is not authorized under this contract.

1.6.19 Training of Personnel

The contractor agrees to train its personnel who have access to the sensitive nature of the information and the relationship under which the contractor has possession of or access to the information. Contractor personnel shall not engage in any other action, venture, or employment wherein sensitive information will be used for the profit of any party other than those furnishing the information. Contractor personnel will complete nondisclosure agreements. The contractor shall restrict access to sensitive/proprietary information to the minimum number of employees necessary for contract performance. The contractor shall be required to coordinate and exchange directly with other contractors information pertinent and essential to performance of work under this contract. The contractor shall discuss and resolve any problems between the Contractor and those contractors designated by DOL. The CO and COTR shall be notified in writing of any disagreement(s), which has (have) not been resolved in a manner so as not to impact the completion of activities or deliverables that is in accordance with the documented and agreed upon project plan and project work-breakdown structure. The contractor shall furnish the CO and COTR all copies of communications between the contractor and associated contractor(s) relative to contract performance. Further, the close interchange with and between contractor(s) may require access to or release of proprietary data. In such an event, the Contractors shall enter into mutually acceptable agreement(s) to protect such proprietary data from unauthorized use or disclosure so long as it remains proprietary.

PART 2

DEFINITIONS & ACRONYMS

CO- Contracting Officer

Contracting Officer’s Representative (COR). A representative from the requiring activity assigned by the Contracting Officer to perform surveillance and to act as liaison to the contractor

Defective Service. A service output that does not meet the standard of performance associated with it in the Performance Work Statement.

Designated Government Representative (DGR) or DGR designee. The government representative designated by the COR.

DOL. Department of Labor

EVM – Earned Value Management

FAR- Federal Acquisition Regulation

FISMA- Federal Information Security Management Act

HSPD- Homeland Security Presidential Directive

ISO0 Information Security Office

ISSO- Information System Security Officer

ISSPA- Information System and Security and Privacy Awareness

IT- Information Technology

MOU- Memorandum of Understanding

NACI- National Agency Check Inquiries

OASAM- Office of the Assistant Secretary for Administration and Management

OCIO- Office of Chief Information Office

OIG- Office of Inspector General

OMB- Office of Management and Budget

PIV- Personal Identity Verification

POP- Period of Performance

PWS. Performance Work Statement

Quality Assurance Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

Quality Control. Those actions taken by a contractor to control the performance of services so that they meet the requirements of the PWS.

Quality Assurance. Those actions taken by the government to assure services meet the requirements of the Performance Work Statement.

SF. Standard Form

SCR- System Change Request

WBS- Work Breakdown Structure

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.1 GENERAL: The government shall provide, the facilities, equipment, materials, and/or services listed below.

3.2.1 Equipment: Appropriate software shall be provided on-site for use in task completion.

3.3 Services: Network connections and telephony access for official work- related calls only

3.3.1 Utilities. All utilities in the facility will be available for the contractor’s use in performance of duties outlined in this PWS. The Contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities.

3.4 Facilities: The Government will furnish the necessary workspace for the contractor staff to provide the support outlined in this PWS to include desk space, telephones, computers and other items necessary to maintain an office environment.

3.5 Information Sources

Knowledgeable MSHA personnel shall be made available to assist contractor personnel in obtaining information pertinent to task. In addition, extensive information regarding MSHA’s business and processes are available via the MSHA Intranet homepage and shall be made available to the contractor personnel.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 General: Except for those items specifically stated to be government furnished in Part 3, the contractor shall furnish everything required to perform this PWS. The Contractor shall ensure that all data delivered via electronic media (by disk, telecommunications transmission, or any other manner of electronic medium) shall be checked and certified as virus free at data point of origin. Virus free electronic media data certification shall be required to accompany all such delivered data identifying the specific certifying party, telephone number, data generation location, date certified, a list of each data item being certified, and the following certifying statement, "All data provided by this delivery is virus free".

All Contractor staff provided under this PWS is subject to Government review and approval. The Contractor is required to remove any employee whose conduct or performance is such that retention would not be in the best interests of the Government.

4.2 Clearance: The Contractor shall possess or be eligible to receive and maintain a clearance as described in TECHNICAL EXHIBIT 4, Contractor Personnel Security Requirements. The Contractor’s employees, performing work in support of this contract shall have been granted a security clearance level as described in TECHNICAL EXHIBIT 4, Contractor Personnel Security Requirements.

4.3 Key Personnel:

The staff covered under this PWS shall be considered “Key Personnel” and key personnel may not be removed or replaced without the written consent of the Government. Any replacement of key personnel must have the same or better qualifications as the person released. Resumes of replaced key personnel must be provided and the Government must approve the replacement before the person starts work. The contractor shall ensure that all personnel filling Key Personnel positions are retained in those positions for a minimum of 180 days following Government approval of their resumes unless the individual leaves the contractor’s employ or is incapacitated. Substitution of Key Personnel either prior to, or after this 180-day period, shall be accomplished only after Government approval. The contractor shall notify the COR 30 days prior to performing any substitution of Key Personnel and submit the resume of the proposed replacement individual with this notification. Key Personnel must have a minimum of 3 years of IT/IT security experience.

The Contractor is required to provide fully trained individuals to meet the requirements of this Contract. The Contractor is responsible for maintaining and enhancing the skills of on-site Contractor staff.

It is critical that the contractor possess extensive knowledge of Government security policies and procedures, and familiarity with Federal Information Security Management Act (FISMA) regulations. The contractor also needs a thorough understanding of infrastructure.

The contractor must also possess the following skills:

· Familiarity with a variety of the IT security field’s concepts, best practices, policies, and procedures.

· Extensive experience in network, database and web application security.

· Knowledgeable of the National Institute of Standards and Technology Special Publications.

· Working knowledge of vulnerability scanning and monitoring.

· In depth knowledge of application, data, and web security.

· Knowledgeable in Windows, and Sun Solaris server operating systems.

· Knowledgeable of Oracle database systems. Understanding of Privacy Act of 1974.

· Excellent verbal, written, and presentation Skills.

· Deep understanding of TCP/IP internetworking principles.

· Familiarity with various web application attack methods including: DDoS, buffer overflows, brute force techniques, among others

4.4 Special Qualifications: The contract requires up to four individuals to fulfill these tasks. One Project Manager, two Information System Analysts and one Information System Auditor. The discipline mix shall be as follows:

· Quantity one (1) - Project Manager

· Quantity two(2) - Information System Analyst

· Quantity one(1) - Information System Auditor Security Analyst/Auditor performance measures based on the successful completion of the day-to-day security defined reports within timeframes specified by the DGR or DGR designee. Performance of day-to-day security auditing operations task shall be measured by the ability of the contractor to detect suspicious activity and generate pre-defined reports within timeframes specified by the DGR or DGR designee.

PART 5

SPECIFIC TASKS

5.1 BASIC SERVICES. The contractor shall provide services to support the Information Security Office (ISO) of MSHA

5.1.1 AUDITOR/ ASSURANCE TASKS

Staff covered under this shall be performing day to day security auditing operations which include but not limited to regular security audits to identify gaps and ensure compliance with DOL Computer Security Handbook (CSH), NIST and DOL security policies, monitoring audit logs to detect unusual activities, analyzing, reporting and participating in remediation activities.

The contractor shall assist ISSO with setting deadlines and assigning contractor staff to carry out tasks. Identify resources needed and assign individual responsibilities. Track the status of projects daily and ensure projects are completed within established deadlines. Monitor and summarize progress of projects.

The contractor shall assist the ISSO in the completion of IT security projects. Create project work plans and revise as appropriate to meet changing needs and requirements.

The contractor shall identify and report all incidents to the ISSO in a timely manner. In the absence of the ISSO or ISSO designee follow DOL approved Incident Response Plan and Procedures and report in a timely manner. Track all incidents and ensure they are closed in timely manner.

The contractor shall assist in the establishment, development, and review of information technology security policies, procedures, standards, and guidelines. Annually review and update all information system security documents to ensure compliance with NIST, DOL and MSHA security policies and procedures. The contractor shall prepare PII Screening Forms, Privacy Impact Assessment, e-authentication risk assessment and memorandums. The contractor shall review, update, monitor and maintain the System Security Plans of MSHA Information Systems and shall define and oversee the implementation of security requirements and controls for the system. The Contractor shall provide support to ensure MSHA IT Security Program complies with the NIST, DOL and MSHA information security policies and procedures. Gaps in security compliance are identified, documented, and handled promptly.

The contractor shall assist in the development, maintenance, and testing of Contingency/ Disaster Recovery/ Incident Response Plans.

The contractor shall develop and participate in the security self-assessment of the system safeguards and program elements and in Security Assessment and Authorization activities. The contractor shall assist the ISSO in facilitating external audits including but not limited to the Office of Inspector General (OIG) audits and the Office of Chief Information Office (OCIO) A-123 assessments for information systems. Under the direction of the ISSO, the contractor shall manage, update, and track weaknesses for the Plan of Action and Milestones (POA&M) for MSHA’s major application system. The contractor shall research and present solutions to fix the weakness found in the Information System. The contractor shall compile list of required exemptions and research, draft and track the status. The contractor shall comply with the DOL IT Security Performance Measures and deliverables.

The contractor shall timely review, update and track interconnection security agreements (ISA) and memorandum of understandings (MOU) between MSHA information system and external information systems.

The contractor shall participate in or perform system vulnerability scanning and/or penetration testing in an effort to annually monitor and mitigate security vulnerabilities for MSHA’s major application. The contractor shall monitor and review system/audit logs for potential security violations, prepare and submit all required reports to the ISSO.

The contractor shall assist and serve as a liaison for MSHA in internal and external meetings, providing reports and updates to the Designated Government Representative (DGR) or DGR designee. When needed, the contractor shall create presentations, providing input from the Information Security Office (ISO).

The contractor shall coordinate Information Systems and Security and Privacy Awareness (ISSPA) training and Role- based training activities for MSHA users.

The contractor shall serve on the MSHA Configuration Management Board to represent ISO, regarding the System Change Request (SCR) process for conducting research, providing guidance, reviewing and approving SCRs. Assist in day to day operations, management, and support such as but not limited to, maintain and submit Work Breakdown Structure (WBS) for quarterly Control Reviews, monthly Earned Value Management (EVM) reporting with support of DOL, OMB, NIST and FISMA initiatives.

The contract shall conduct research by way of but not limited to; vendor demos, white papers and attending seminars for evaluation on new and existing technologies to aid the business benefit of MSHA. The contractor shall provide un-biased appraisals of technologies in order to assist in MSHAs missions. The contractor needs to remain up to date on the latest state of the art Information Technology (IT) Security tools in order to brief federal staff and possibly incorporate the latest tools to MSHA’s arsenal.

The contractor shall provide a detailed Work Breakdown Structure (WBS) identifying deliverables, timelines, dependencies, and status within 30 Days of Kick-off meeting. Review and update WBS quarterly throughout the life of the project

5.1.2 Documentation

The contractor shall be provided all necessary documentation pertinent to the task

PART 6

APPLICABLE PUBLICATIONS

6.1 Publications applicable to this PWS are listed below. NIST standards and OMB security related memorandum are publicly available and were used as a basis for the following:

Department of Labor Manual Series (DLMS) – Policies and Procedures:

· DLMS 9, 400: IT Security – Purpose. This document establishes policy and assigns organizational and management responsibilities to ensure the implementation of Departmental and underlying Federal Information Systems Security (ISS) throughout DOL.

· DLMS 9-900 – Appropriate Use of IT. This document establishes policy guidance and responsibilities for the appropriate use and management of Department of Labor (“DOL” or “the Department”) Information Technology and Government Furnished Equipment (GFE) and related systems. These terms are defined below, and are intended to cover a broad range of DOL owned or managed data, information, systems, software, and programs.

· DLMS 9-1200 – Safeguarding Sensitive Data Including Personally Identifiable Information. This chapter establishes policy guidance and responsibilities for the safeguarding of agency sensitive data including personally identifiable information (PII) that is accessed, processed, transported, or stored on end-user computing devices and portable media.

· DLMS 9, 400.403: IT Security – Policy. The DOL will protect its information and information systems from unauthorized users and use and from threats to integrity, availability, authenticity, confidentiality, and nonrepudiation. It is DOL policy to implement and maintain an ISS program that ensures adequate protection for all information and information systems that collect, process, transmit, store, and/or disseminate information. The ISS program must meet all DOL and other applicable Federal statutes and regulations governing this area.

· DLMS 5, 200: The Privacy Act of 1974 and Invasion of Privacy 5 CFR Part 2635 - Standards of Ethical Conduct for Employees of the Executive Branch 29 CFR Part 71 - Protection of Individual Privacy and Access to Records

Department of Labor Computer Security Handbook (CSH):

· Volume 0 – Information Security Policies

· Volume 1 – Access Controls

· Volume 2 – Awareness and Training

· Volume 3 – Audit and Accountability

· Volume 4 – Security Assessment and Authorization

· Volume 5 – Configuration Management

· Volume 6 – Contingency Planning

· Volume 7 – Identification and Authentication

· Volume 8 – Incident Response

· Volume 9 – Maintenance

· Volume 10 – Media Protection

· Volume 11 – Physical and Environmental Protection

· Volume 12 – Security Planning

· Volume 13 – Personnel Security

· Volume 14 – Risk Assessment

· Volume 15 – System and Services Acquisition

· Volume 16 – System and Communications Protection

· Volume 17 – System and Information Integrity

· Volume 18 – Program Management

· Volume 19 – Cloud Computing Security New item

· Volume 20 – Inventory Methodology

· Volume 21 – Information Privacy

TECHNICAL EXHIBIT 1

Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective (The Service required—usually a shall statement)

Method of Surveillance (and who performs) {e.g. 100% inspection by COR}

PRS # 1. The Contractor shall provide support so that the MSHA IT Security Program complies with the NIST, DOL and MSHA information security policies and procedures. Gaps in security compliance are identified, documented, and handled promptly.

Paragraph 4 of Section 5.1.1 AUDITOR/ ASSURANCE TASKS

PRS # 2 The contractor shall comply with the DOL IT Security Performance Measures and deliverables.

Paragraph 6 of Section 5.1.1 AUDITOR/ ASSURANCE TASKS

TECHNICAL EXHIBIT 2

DELIVERABLES SCHEDULE

Annually review and update all information system security documents to ensure compliance with NIST, DOL and MSHA security policies and procedures.

Paragraph 4 of Section 5.1.1 AUDITOR/ ASSURANCE TASKS Annual or whenever there is major change in the system.

COR and DGR

The contractor shall review, update, monitor and maintain the System Security Plans of Major Information System and shall define and oversee the implementation of security requirements and controls for the system

Paragraph 4 of Section 5.1.1 AUDITOR/ ASSURANCE TASKS Annual or whenever there is major change in the system.

TECHNICAL EXHIBIT 3

ESTIMATED WORKLOAD DATA

ITEM

NAME

ESTIMATED QUANTITY

TECHNICAL EXHIBIT 4

Contractor Personnel Security Requirements.

FAR 4.404 SECURITY REQUIREMENTS

1. Contractor’s staff is required to conform to DOL's security and privacy requirements as described below.

1.1 CONTRACTOR SUITABILITY - BACKGROUND INVESTIGATIONS

MSHA’s data , documents, and work environment are considered sensitive, but unclassified. DOL and MSHA are required under the Homeland Security Presidential Directive (HSPD) 12 “Policy for a Common Identification Standard for Federal Employees and Contractors” to perform a National Agency Check with Inquiries (NACI) for Contractors. The NACI is a brief form of background investigation that is conducted through the Office of Personnel Management. This investigation will be conducted for Contractor staff assigned to this Contract. Contract staff will be required to provide two forms of acceptable identification, provide a current photograph, and be finger-printed. Successful clearance is required for an employee to continue working under this Contract. Per the PERSONAL IDENTITY VERIFICATION OF CONTRACT PERSONNEL clause of the Federal Acquisition Regulation (FAR 52.204-9).

As a requirement of HSPD-12, all eligible employees MUST be fingerprinted and results successfully adjudicated by the Department of Labor. Additionally, a background investigation, based on position risk, must be initiated. No employee is allowed to begin work at DOL, if the above criteria are not met.

a. Background Investigation Requirements. The investigation requirements for contractor employees are based on the risk or sensitivity level designation of the position. The Contracting Officer, Contracting Officer's Technical Representative, or other DOL Agency's designated official informs the Contractor of the risk or sensitivity level for each contractor employee position. The minimum level of investigation for each risk or sensitivity level is indicated below.

* Individuals occupying Critical-Sensitive positions (i.e., require Top Secret security clearances) are subject to reinvestigation every 5 years. Individuals occupying Noncritical-Sensitive positions are subject to reinvestigation every 10 years for Secret security clearances and every 15 years for confidential security clearances.

b. Conducting Background Investigations. All contract employees require a background investigation. The Office of Personnel Management (OPM) will conduct background investigations for DOL employees and contractor employees. Since OPM only accepts requests from Federal agencies to conduct background investigations, the DOL Agency will make arrangements with the Contractor to send the contractor employee's completed papers to the DOL Agency for submission to OPM.

c. Payment for Background Investigation. Contractor will be responsible for all cost associated with background investigation for contractor employees.

1.1.3. Investigation Process:

If the Contractor chooses to complete employee investigations, consistent with the requirements of HSPD-12 and the Department of Labor’s Personal Identity Verification (PIV) process, the Contractor shall submit written procedures to the designated DOL Agency official describing the method by which the following investigation requirements will be satisfied.

a. Pre-employment Checks. Before a contractor employee can begin work for…